Vulnerabilities

TI-2022-18133 CVE-2022-38545 · GHSA-mcvg-g9wx-v5vx

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability…

HIGH 66

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.34128 Published 2022-09-19 Fixed in 1.5.0 CWE-79

TI-2020-17409 CVE-2020-28847 · GHSA-6xvq-2gj8-4276

Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.

LOW 25

Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00472 Published 2022-04-05 Fixed in 1.4.15 CWE-79

TI-2021-13797 CVE-2021-34801 · GHSA-p2c4-gxp4-j3xp

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage)…

LOW 27

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01721 Published 2021-06-16 No fix listed CWE-94

TI-2018-13676 CVE-2018-19289 · GHSA-hhrp-qm88-xjr3

An issue was discovered in Valine v1.3.3.

LOW 30

An issue was discovered in Valine v1.3.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01228 Published 2018-11-15 Fixed in 1.3.4 CWE-79

Vulnerabilities

Filters

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability…

Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage)…

An issue was discovered in Valine v1.3.3.